A team cannot determine which customer records were accessed because application audit events were never collected. What is the most important follow-up?

1. Report every record as certainly accessed without qualification
2. Delete the incident because scope is uncertain
3. Address logging coverage and retention needed for future scoping and investigation
4. Assume no records were accessed because there is no log